Cyprus Wing of Auditing Giant PwC May Have Breached Sanctions in Work for Oligarch

As Russian tanks rolled into Ukraine in late February 2022, staff at the Cypriot wing of international auditing giant PwC were rushing to tie up the sale of hundreds of millions of dollars’ worth of assets owned by Russian oligarch Alexey Mordashov.

Like other pro-Kremlin billionaires, Mordashov — described by Forbes as Russia’s richest person in 2021 — was at risk of having his European assets frozen if authorities sanctioned him in response to the invasion.

At PwC Cyprus, staff exchanged documents marked “URGENT” and “PLEASE APPROVE” as they prepared paperwork to sell Mordashov’s stake in German travel company TUI Group — reportedly worth well over $1 billion — to a British Virgin Islands company owned by his life partner, Maria Mordashova.

The Financial Times described the sale as an attempt by Mordashov to “outpace{:target="_blank}” EU sanctions.

TUI’s public statements in March 2022 indicated that the sale had gone through on February 28, the day Mordashov was sanctioned. However German authorities quickly ruled the share transfer “provisionally invalid,” and launched an investigation, TUI said in a March 2022 press release. They didn’t end up opening proceedings because the transfer “took place exclusively in Cyprus,” but they informed “supervisory authorities in Cyprus” about the deal, according to the Hanover Public Prosecutor’s Office.

Now, leaked records suggest the arrangements may not in fact have been finalized by the time Mordashov was blacklisted, raising serious questions about whether PwC Cyprus breached EU sanctions.

Asked for comment on the new findings, Cypriot authorities confirmed that an investigation had been launched into the share transfer.

Kyriacos Iordanou, director general of Cyprus’s accountants and auditors supervisor ICPAC (The Institute of Certified Public Accountants of Cyprus), told OCCRP the transfer "came to our attention and was examined a few months ago” and that they “took the appropriate actions…pursuant to the provisions of the law."

A Cypriot sanctions unit inside the country’s Ministry of Finance told OCCRP’s international media partners that they are “aware of TUI share transfers and a criminal investigation is being carried out.” Cypriot government spokesperson Konstantinos Letymbiotis said he “cannot comment on an ongoing investigation.”

PwC Cyprus said it was unaware of the investigation. “Whenever there is a reportable event, PwC Cyprus takes appropriate action,” the firm said.

TUI also said it was not aware of a Cypriot investigation but based on the information presented by reporters it assumed the share transfer “was not effective.” A spokesperson for Mordashov said he had never broken “any laws, whether in Europe, Russia, or any other jurisdictions,” and said the sanctions against him were “entirely unfounded and unjust, running counter to international legal norms, not to mention common sense.”

The leaked documents come from Cypcodirect Ltd, a Cypriot corporate services provider that worked closely with PwC Cyprus. The internal files include extensive correspondence with PwC staff and paperwork prepared by PwC Cyprus.

The Cypcodirect leak is one of seven that make up Cyprus Confidential, a global investigative collaboration led by the International Consortium of Investigative Journalists (ICIJ) and Paper Trail Media.

In response to the Russian invasion, PwC announced in March 2022 that its member firm in Russia would “leave the Network” and that all PwC member firms would exit “any work for Russian entities or individuals subject to sanctions.”

An analysis of the leaked data by ICIJ suggests that 39 Russian clients of PwC Cyprus were hit with sanctions by the EU, U.K., United States or Ukraine because of their close ties to Putin or their prominent roles in economic sectors critical to his regime’s war in Ukraine.

It’s not clear whether PwC Cyprus worked with these clients at the time they were sanctioned. PwC declined to comment on specific clients due to confidentiality obligations, but said PwC Cyprus had “terminated relationships with approximately 150” clients following the Russian invasion in 2022.

“All PwC firms, including PwC Cyprus, take the application of sanctions against clients and sanctions prohibiting various professional services extremely seriously,” the firm said in a statement. “PwC’s internal standards are reviewed and updated to reflect both lessons learned and changing circumstances, and we do not hesitate to take action when our standards are not met. Any allegation of non compliance with applicable laws and regulations is taken very seriously, investigated and appropriate action is taken if necessary.”

Cypcodirect said the firm has always worked “in line with applicable laws and regulations,” but could not comment further due to client confidentiality.

‘Please Re-Sign Originals’

At 8 p.m. Central European Time on February 28, 2022, the EU published an updated list of sanctioned individuals. It included Mordashov, whom the EU accused of “benefitting from his links with Russian decision-makers,” doing business in occupied Crimea, and having an interest in pro-Kremlin media.

Just 80 minutes earlier, an assistant manager at PwC in Cyprus had forwarded files related to Mordashov’s TUI share transfer to a director at the firm, asking him to “approve the execution” of the attached documents.

Five minutes later, the director responded, “Approved.” TUI later issued a press release saying the shares had been sold to Mordashov’s partner Mordashova on February 28. Leaked internal documents also note that the share sale and purchase agreement was dated February 28.

The sale would have insulated the shares from potential seizure by getting them out of the hands of a now-sanctioned individual and into those of Mordashova, who was not sanctioned by the EU, U.S., or U.K. at the time.

However the leaked documents raise the possibility that the transfer had not been completed by the time Mordashov was sanctioned. One of the emails, sent at 6:43 p.m. Central European Time on February 28, says, regarding the sale of the shares, “Price will be finalised in a while,” suggesting that the urgent last-minute exchange of messages may not have been the final step in the process.

“It is not uncommon for financial transactions to be agreed one day and settled several days later,” said Tom Keatinge, director of the Centre for Financial Crime and Security Studies at the U.K.-based think tank Royal United Services Institute. “That said, at the time a transaction is agreed, you would expect that to include the price. It is therefore possible that in this case there was an urgency to agree the ‘legal’ elements of the sale to be able to evidence that the sale had occurred but that the price was still being negotiated.”

Staff at the auditing firm’s office may have even continued to work on the deal after the announcement of Mordashov’s blacklisting: The approval of the share agreement documents was forwarded again in the afternoon of March 1, 2022.

Alongside the leaked emails are two documents related to the share sale and purchase agreement. One of them, a list of “documents for signature,” appears to have been scanned with a handwritten note attached that says “Urgent, please re-sign originals, which was [sic] signed on 28.02.2022. Thank you.” The document was dated March 1, suggesting the process had not been completed by the time Mordashov was sanctioned.

“You can sign an agreement in principle with conditions subsequent,” Alexander Dmitrenko, a partner at the law firm Ashurst focusing on sanctions and compliance, told OCCRP. “But the critical question (under Cypriot law) is then at which point the shares were transferred — straight away, or when the conditions subsequent were completed?”

The other document, titled “Review Form,” includes what appears to be a checklist of documents and processes to be completed. Some boxes are checked, but one next to “We have checked the counterparty of the transaction/attorney against sanction lists” was not ticked off. The date March 2, 2022 is handwritten at the top of the form.

Kush Amin, a lawyer at Transparency International, said the emails and attachments raise the possibility that PwC Cyprus was still doing work for Mordashov after he had been sanctioned by Brussels.

“The transfer warrants further investigation because the records indicate that it may have been properly effected only after the [sanctions] designation,” said Amin.

PwC Cyprus may even have breached EU sanctions by working on the share sale on February 28, 2022. EU officials told OCCRP’s partners Paper Trail Media and the Guardian that sanctions come into force “at the beginning of the first hour of the day of publication” of the sanctions notice in the Official Journal. This means Mordashov was technically under sanctions throughout the day on February 28, 2022, though it is possible that neither he nor PwC were aware of his blacklisting until it was announced in the evening.

Dmitrenko said that any company operating inside the EU should take active steps to avoid undermining EU sanctions.

“EU entities should not support any circumvention of sanctions. Any attempt to undermine the impact of sanctions is absolutely inappropriate and could result in a violation of applicable laws and regulations,” he said.

The target of the Cypriot criminal investigation is unknown.

TUI said the company “fully implements all sanctions imposed” by the EU, U.S. and the U.K. and that Mordashov “does not receive any dividends and cannot derive any economic benefit from the shareholding.”

Mordashova was sanctioned by the EU in June 2022, and by the U.K. last week. She did not respond to questions sent by OCCRP’s media partners.

An Email Marked ‘URGENT’

On March 1, 2022, as PwC staff traded emails related to Mordashov’s share transfer, British parliamentarians gathered for a debate about sanctioning Russian oligarchs. Dame Margaret Hodge stood and read out a shortlist of candidates for blacklisting that she had picked out due to their links to the U.K. The first person she named was Alexander Abramov. Moments later she also highlighted his business partner Alexander Frolov.

Billionaires Abramov and Frolov, business partners of the oligarch Roman Abramovich, made their fortunes in post-Soviet Russia. Until 2022, they co-owned Evraz PLC, a Russian metals giant that played a key role in the Russian railway sector. They were also clients of PwC Cyprus.

On the same day as Hodge’s speech, PwC staff were trying to hurriedly arrange for the transfer of $100 million between a Cyprus company co-owned by Abramov and Frolov to another of their firms, in the British Virgin Islands (BVI). It’s not clear whether this was part of a strategy to mitigate the risk of potential future sanctions, but the move would have put the funds out of the reach of EU and U.S. sanctioning authorities.

Keatinge said Russian oligarchs had often been able to restructure their assets in early 2022 before sanctions were announced because Western governments had publicly threatened to impose sanctions if Russia invaded Ukraine.

“Any right-minded oligarch would have developed a risk mitigation plan if they felt that this threat of sanctions included them,” Keatinge said.

The leaked records indicate staff at PwC Cyprus were moving quickly to reorganize Abramov and Frolov’s assets. In an email marked “URGENT,” a manager at PwC Cyprus asked a colleague at Cypcodirect to sign off on a loan document between the two companies, Moravian Limited in Cyprus and Finassets Limited in the BVI.

The source of the funds was Evraz dividends to Frolov and Abramov, according to the PwC manager’s email, who told his Cypcodirect counterpart that other documents, including board minutes, were “being prepared and will be sent shortly” but “the loan document is only document we need signed now.”

The Cypcodirect staff member signed the document, according to the emails.

It’s not clear whether the $100 million was actually moved to the BVI. But the next day, PwC Cyprus staff were again helping Abramov and Frolov insulate hundreds of millions of dollars from potential sanctions, as the pair transferred assets to their sons.

On March 2, Abramov and Frolov’s shares in Moravian were transferred to Egor Abramov and Alexander Alexandrovich Frolov, the sons of the two businessmen, who were not considered at risk of being sanctioned.

Moravian’s company records do not indicate any specific economic activity, but it had access to considerable cash because, in December 2021, Abramov and Frolov had loaned it $200.1 million and $99.9 million, respectively.

A PwC “review form,” dated March 28, 2022, indicates that a company owned by Frolov and its subsidiary loaned Moravian another $200 million, in two loans of $100 million each.

In early April 2022, Abramov and Frolov signed over the rights to the December 2021 loans, totalling $300 million, to their sons. It’s not clear whether Frolov also gifted the rights to the March 2022 loans to his son.

As expected, the U.K. placed Evraz under sanctions in May 2022, declaring the company to be “of strategic significance to the government of Russia” because it produced 97 percent of Russia’s railway tracks and nearly a third of its railway wheels. Then in November 2022, the U.K. imposed personal asset freezes and travel bans on Abramov and Frolov, calling them members of a “cabal of selected elite” that Russian President Vladimir Putin relies on.

The U.S. and EU have not sanctioned Abramov or Frolov. Neither man responded to requests for comment.